INSTEON Hub 2242-222 Lack Of Authentication

Description

`Trustwave SpiderLabs Security Advisory TWSL2013-023:
Lack of Web and API Authentication Vulnerability in INSTEON Hub
Published: 8/01/13
Version: 1.0
Vendor: INSTEON (http://www.INSTEON.com/)
Product: Hub
Version affected: 2242-222 (model discontinued)
Product description:
Home automation controller for INSTEON and X10 compatible devices such as,
lights, RF deadbolts/door locks, Window/door sensors, thermostats, etc.
Finding 1: Lack of Web and API Authentication
*****Credit: David Bryan of Trustwave SpiderLabs
CVE: CVE-2013-4859
CWE: CWE-306
The INSTEON Hub allows users to control their home automation devices from
their home, and across the Internet. To allow control of the devices from
the Internet requires that a user create a port forward from the Internet
to the Hub on their home network. This is to allow direct access from a
users smart phone. The hub will display a web page that is a legacy of their
previous hardware version of home automation control systems. This page
allows anonymous access to control any devices connected to the Hub, if the
user has not set a user name and password. Additionally it reveals the
name of the device, and what city and timezone the device is located.
Because INSTEON does not restrict the user in the naming of their device,
it is possible for users to use their street address in the naming. Having
access to the name of the city, make locating the device trivial using
mapping software to search for the house and street name of the controller,
and potentially identify the location of the device. The web interface
does not require the user to set authentication or authorization to make
requests to the Hub. This allows an anonymous threat agent access to turn
on and off lights/devices, change temperature settings on thermostats, or
even open electronic door locks. Additionally a threat agent also has
access to a buffer command, where they can see what lights or devices were
turned on or off. For example, an ON Command is a simple GET request of:
http://A.B.C.D:8001/3?0262XXYYZZ0F11FF=I=3
This turns on the device, and does not require authentication to perform
this action. XXYYZZ is the ID of the INSTEON device.
An OFF Command is a simple GET request of:
http://A.B.C.D:8001/3?0262XXYYZZ0F1100=I=3
This turns the device off, and does not require authentication to perform
this action.
http://A.B.C.D:8001/buffstatus.xml request, without any sort of authentication taking place:
&lt;response&gt;&lt;BS&gt;02622026AA0F11FF0602502026AA1E965F2F11FF000000000000000000000000000000000000000000000000000000000000&lt;/BS&gt;&lt;/response&gt;
&gt;From that response,it is possible to gather what INSTEON devices that were last used.
&gt;From there an attacker can then go back and easily decode the buffer status
message and turn those devices on or off.
Additionally, the device does not have the capability to enable SSL/TLS to
encrypt the data in transit. This allows any anonymous threat agent to
view, intercept, and replay commands. It also does not prevent someone
from capturing authentication credentials when the device is accessed via
the Internet.
Remediation Steps:
The vendor has recalled and discontinued affected units. Trustwave
SpiderLabs has confirmed that Model 2422-222R is not affected by this
vulnerability.
Vendor Communication Timeline:
12/27/12 - Vulnerability disclosed to vendor
03/16/13 - Vendor emails upgrade notice
07/17/13 - Advisory disclosed to vendor
08/01/13 - Advisory published
References
1. http://www.INSTEON.com/support.html
About Trustwave:
Trustwave is the leading provider of on-demand and subscription-based
information security and payment card industry compliance management
solutions to businesses and government entities throughout the world. For
organizations faced with today's challenging data security and compliance
environment, Trustwave provides a unique approach with comprehensive
solutions that include its flagship TrustKeeper compliance management
software and other proprietary security solutions. Trustwave has helped
thousands of organizations--ranging from Fortune 500 businesses and large
financial institutions to small and medium-sized retailers--manage
compliance and secure their network infrastructure, data communications and
critical information assets. Trustwave is headquartered in Chicago with
offices throughout North America, South America, Europe, Africa, China and
Australia. For more information, visit https://www.trustwave.com
About Trustwave SpiderLabs:
SpiderLabs(R) is the advanced security team at Trustwave focused on
application security, incident response, penetration testing, physical
security and security research. The team has performed over a thousand
incident investigations, thousands of penetration tests and hundreds of
application security tests globally. In addition, the SpiderLabs Research
team provides intelligence through bleeding-edge research and proof of
concept tool development to enhance Trustwave's products and services.
https://www.trustwave.com/spiderlabs
Disclaimer:
The information provided in this advisory is provided "as is" without
warranty of any kind. Trustwave disclaims all warranties, either express or
implied, including the warranties of merchantability and fitness for a
particular purpose. In no event shall Trustwave or its suppliers be liable
for any damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages, even if
Trustwave or its suppliers have been advised of the possibility of such
damages. Some states do not allow the exclusion or limitation of liability
for consequential or incidental damages so the foregoing limitation may not
apply.
________________________________
This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.
`

All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018

Protected by

{"type": "packetstorm", "published": "2013-08-02T00:00:00", "reporter": "David Bryan", "objectVersion": "1.2", "bulletinFamily": "exploit", "cvss": {"vector": "NONE", "score": 0.0}, "sourceData": "`Trustwave SpiderLabs Security Advisory TWSL2013-023: \nLack of Web and API Authentication Vulnerability in INSTEON Hub \n \nPublished: 8/01/13 \nVersion: 1.0 \n \nVendor: INSTEON (http://www.INSTEON.com/) \nProduct: Hub \n \nVersion affected: 2242-222 (model discontinued) \n \nProduct description: \nHome automation controller for INSTEON and X10 compatible devices such as, \nlights, RF deadbolts/door locks, Window/door sensors, thermostats, etc. \n \nFinding 1: Lack of Web and API Authentication \n*****Credit: David Bryan of Trustwave SpiderLabs \nCVE: CVE-2013-4859 \nCWE: CWE-306 \n \nThe INSTEON Hub allows users to control their home automation devices from \ntheir home, and across the Internet. To allow control of the devices from \nthe Internet requires that a user create a port forward from the Internet \nto the Hub on their home network. This is to allow direct access from a \nusers smart phone. The hub will display a web page that is a legacy of their \nprevious hardware version of home automation control systems. This page \nallows anonymous access to control any devices connected to the Hub, if the \nuser has not set a user name and password. Additionally it reveals the \nname of the device, and what city and timezone the device is located. \n \nBecause INSTEON does not restrict the user in the naming of their device, \nit is possible for users to use their street address in the naming. Having \naccess to the name of the city, make locating the device trivial using \nmapping software to search for the house and street name of the controller, \nand potentially identify the location of the device. The web interface \ndoes not require the user to set authentication or authorization to make \nrequests to the Hub. This allows an anonymous threat agent access to turn \non and off lights/devices, change temperature settings on thermostats, or \neven open electronic door locks. Additionally a threat agent also has \naccess to a buffer command, where they can see what lights or devices were \nturned on or off. For example, an ON Command is a simple GET request of: \n \n \nhttp://A.B.C.D:8001/3?0262XXYYZZ0F11FF=I=3 \n \nThis turns on the device, and does not require authentication to perform \nthis action. XXYYZZ is the ID of the INSTEON device. \n \nAn OFF Command is a simple GET request of: \nhttp://A.B.C.D:8001/3?0262XXYYZZ0F1100=I=3 \n \nThis turns the device off, and does not require authentication to perform \nthis action. \n \nhttp://A.B.C.D:8001/buffstatus.xml request, without any sort of authentication taking place: \n \n<response><BS>02622026AA0F11FF0602502026AA1E965F2F11FF000000000000000000000000000000000000000000000000000000000000</BS></response> \n \n>From that response,it is possible to gather what INSTEON devices that were last used. \n>From there an attacker can then go back and easily decode the buffer status \nmessage and turn those devices on or off. \n \nAdditionally, the device does not have the capability to enable SSL/TLS to \nencrypt the data in transit. This allows any anonymous threat agent to \nview, intercept, and replay commands. It also does not prevent someone \nfrom capturing authentication credentials when the device is accessed via \nthe Internet. \n \n \nRemediation Steps: \nThe vendor has recalled and discontinued affected units. Trustwave \nSpiderLabs has confirmed that Model 2422-222R is not affected by this \nvulnerability. \n \nVendor Communication Timeline: \n12/27/12 - Vulnerability disclosed to vendor \n03/16/13 - Vendor emails upgrade notice \n07/17/13 - Advisory disclosed to vendor \n08/01/13 - Advisory published \n \nReferences \n1. http://www.INSTEON.com/support.html \n \nAbout Trustwave: \nTrustwave is the leading provider of on-demand and subscription-based \ninformation security and payment card industry compliance management \nsolutions to businesses and government entities throughout the world. For \norganizations faced with today's challenging data security and compliance \nenvironment, Trustwave provides a unique approach with comprehensive \nsolutions that include its flagship TrustKeeper compliance management \nsoftware and other proprietary security solutions. Trustwave has helped \nthousands of organizations--ranging from Fortune 500 businesses and large \nfinancial institutions to small and medium-sized retailers--manage \ncompliance and secure their network infrastructure, data communications and \ncritical information assets. Trustwave is headquartered in Chicago with \noffices throughout North America, South America, Europe, Africa, China and \nAustralia. For more information, visit https://www.trustwave.com \n \nAbout Trustwave SpiderLabs: \nSpiderLabs(R) is the advanced security team at Trustwave focused on \napplication security, incident response, penetration testing, physical \nsecurity and security research. The team has performed over a thousand \nincident investigations, thousands of penetration tests and hundreds of \napplication security tests globally. In addition, the SpiderLabs Research \nteam provides intelligence through bleeding-edge research and proof of \nconcept tool development to enhance Trustwave's products and services. \nhttps://www.trustwave.com/spiderlabs \n \nDisclaimer: \nThe information provided in this advisory is provided \"as is\" without \nwarranty of any kind. Trustwave disclaims all warranties, either express or \nimplied, including the warranties of merchantability and fitness for a \nparticular purpose. In no event shall Trustwave or its suppliers be liable \nfor any damages whatsoever including direct, indirect, incidental, \nconsequential, loss of business profits or special damages, even if \nTrustwave or its suppliers have been advised of the possibility of such \ndamages. Some states do not allow the exclusion or limitation of liability \nfor consequential or incidental damages so the foregoing limitation may not \napply. \n \n________________________________ \n \nThis transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. \n \n \n`\n", "viewCount": 0, "history": [], "edition": 1, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "eee8e95e379d1957b62b188b74f49718"}, {"key": "cvss", "hash": "8cd4821cb504d25572038ed182587d85"}, {"key": "description", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "href", "hash": "85bde42b8368de768dfa0ec0298c234b"}, {"key": "modified", "hash": "ed7debfcc95a69e407d92a3b40cd76f7"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "ed7debfcc95a69e407d92a3b40cd76f7"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "d520e3fbcda1d5b6ef8d7bd06b0c25a4"}, {"key": "sourceData", "hash": "bc199bd3683705967681c7df15cbf346"}, {"key": "sourceHref", "hash": "2b82102984ea1aea7c4ffa772e748a82"}, {"key": "title", "hash": "42d2a71f8a8b95da972f55892d33ad39"}, {"key": "type", "hash": "6466ca3735f647eeaed965d9e71bd35d"}], "href": "https://packetstormsecurity.com/files/122658/INSTEON-Hub-2242-222-Lack-Of-Authentication.html", "sourceHref": "https://packetstormsecurity.com/files/download/122658/TWSL2013-023.txt", "title": "INSTEON Hub 2242-222 Lack Of Authentication", "enchantments": {"score": {"vector": "NONE", "value": 7.5}, "vulnersScore": 7.5}, "references": [], "id": "PACKETSTORM:122658", "hash": "9067e2a60e1a721018f0c4f297743d44781a0561165623d35369bc9e150b36d9", "lastseen": "2016-12-05T22:16:46", "cvelist": ["CVE-2013-4859"], "modified": "2013-08-02T00:00:00", "description": ""}

{"seebug": [{"lastseen": "2017-11-19T13:23:22", "_object_types": ["robots.models.base.Bulletin", "robots.models.seebug.SeebugBulletin"], "enchantments_done": [], "references": [], "description": "No description provided by source.", "reporter": "Root", "published": "2014-07-01T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "type": "seebug", "title": "INSTEON Hub 2242-222 - Lack of Web and API Authentication", "bulletinFamily": "exploit", "cvelist": ["CVE-2013-4859"], "_object_type": "robots.models.seebug.SeebugBulletin", "modified": "2014-07-01T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-80898", "id": "SSV:80898", "sourceData": "\n Trustwave SpiderLabs Security Advisory TWSL2013-023:\r\nLack of Web and API Authentication Vulnerability in INSTEON Hub\r\n\r\nPublished: 8/01/13\r\nVersion: 1.0\r\n\r\nVendor: INSTEON (http://www.INSTEON.com/)\r\nProduct: Hub\r\n\r\nVersion affected: 2242-222 (model discontinued)\r\n\r\nProduct description:\r\nHome automation controller for INSTEON and X10 compatible devices such as,\r\nlights, RF deadbolts/door locks, Window/door sensors, thermostats, etc.\r\n\r\nFinding 1: Lack of Web and API Authentication\r\n*****Credit: David Bryan of Trustwave SpiderLabs\r\nCVE: CVE-2013-4859\r\nCWE: CWE-306\r\n\r\nThe INSTEON Hub allows users to control their home automation devices from\r\ntheir home, and across the Internet. To allow control of the devices from\r\nthe Internet requires that a user create a port forward from the Internet\r\nto the Hub on their home network. This is to allow direct access from a\r\nusers smart phone. The hub will display a web page that is a legacy of their\r\nprevious hardware version of home automation control systems. This page\r\nallows anonymous access to control any devices connected to the Hub, if the\r\nuser has not set a user name and password. Additionally it reveals the\r\nname of the device, and what city and timezone the device is located.\r\n\r\nBecause INSTEON does not restrict the user in the naming of their device,\r\nit is possible for users to use their street address in the naming. Having\r\naccess to the name of the city, make locating the device trivial using\r\nmapping software to search for the house and street name of the controller,\r\nand potentially identify the location of the device. The web interface\r\ndoes not require the user to set authentication or authorization to make\r\nrequests to the Hub. This allows an anonymous threat agent access to turn\r\non and off lights/devices, change temperature settings on thermostats, or\r\neven open electronic door locks. Additionally a threat agent also has\r\naccess to a buffer command, where they can see what lights or devices were\r\nturned on or off. For example, an ON Command is a simple GET request of:\r\n\r\n\r\nhttp://A.B.C.D:8001/3?0262XXYYZZ0F11FF=I=3\r\n\r\nThis turns on the device, and does not require authentication to perform\r\nthis action. XXYYZZ is the ID of the INSTEON device.\r\n\r\nAn OFF Command is a simple GET request of:\r\nhttp://A.B.C.D:8001/3?0262XXYYZZ0F1100=I=3\r\n\r\nThis turns the device off, and does not require authentication to perform\r\nthis action.\r\n\r\nhttp://A.B.C.D:8001/buffstatus.xml request, without any sort of authentication taking place:\r\n\r\n&#60;response&#62;&#60;BS&#62;02622026AA0F11FF0602502026AA1E965F2F11FF000000000000000000000000000000000000000000000000000000000000&#60;/BS&#62;&#60;/response&#62;\r\n\r\n&#62;From that response,it is possible to gather what INSTEON devices that were last used.\r\n&#62;From there an attacker can then go back and easily decode the buffer status\r\nmessage and turn those devices on or off.\r\n\r\nAdditionally, the device does not have the capability to enable SSL/TLS to\r\nencrypt the data in transit. This allows any anonymous threat agent to\r\nview, intercept, and replay commands. It also does not prevent someone\r\nfrom capturing authentication credentials when the device is accessed via\r\nthe Internet.\r\n\r\n\r\nRemediation Steps:\r\nThe vendor has recalled and discontinued affected units. Trustwave\r\nSpiderLabs has confirmed that Model 2422-222R is not affected by this\r\nvulnerability.\r\n\r\nVendor Communication Timeline:\r\n12/27/12 - Vulnerability disclosed to vendor\r\n03/16/13 - Vendor emails upgrade notice\r\n07/17/13 - Advisory disclosed to vendor\r\n08/01/13 - Advisory published\r\n\r\nReferences\r\n1. http://www.INSTEON.com/support.html\r\n\r\nAbout Trustwave:\r\nTrustwave is the leading provider of on-demand and subscription-based\r\ninformation security and payment card industry compliance management\r\nsolutions to businesses and government entities throughout the world. For\r\norganizations faced with today&#39;s challenging data security and compliance\r\nenvironment, Trustwave provides a unique approach with comprehensive\r\nsolutions that include its flagship TrustKeeper compliance management\r\nsoftware and other proprietary security solutions. Trustwave has helped\r\nthousands of organizations--ranging from Fortune 500 businesses and large\r\nfinancial institutions to small and medium-sized retailers--manage\r\ncompliance and secure their network infrastructure, data communications and\r\ncritical information assets. Trustwave is headquartered in Chicago with\r\noffices throughout North America, South America, Europe, Africa, China and\r\nAustralia. For more information, visit https://www.trustwave.com\r\n\r\nAbout Trustwave SpiderLabs:\r\nSpiderLabs(R) is the advanced security team at Trustwave focused on\r\napplication security, incident response, penetration testing, physical\r\nsecurity and security research. The team has performed over a thousand\r\nincident investigations, thousands of penetration tests and hundreds of\r\napplication security tests globally. In addition, the SpiderLabs Research\r\nteam provides intelligence through bleeding-edge research and proof of\r\nconcept tool development to enhance Trustwave&#39;s products and services.\r\nhttps://www.trustwave.com/spiderlabs\r\n\r\nDisclaimer:\r\nThe information provided in this advisory is provided &#34;as is&#34; without\r\nwarranty of any kind. Trustwave disclaims all warranties, either express or\r\nimplied, including the warranties of merchantability and fitness for a\r\nparticular purpose. In no event shall Trustwave or its suppliers be liable\r\nfor any damages whatsoever including direct, indirect, incidental,\r\nconsequential, loss of business profits or special damages, even if\r\nTrustwave or its suppliers have been advised of the possibility of such\r\ndamages. Some states do not allow the exclusion or limitation of liability\r\nfor consequential or incidental damages so the foregoing limitation may not\r\napply.\r\n\r\n________________________________\r\n\r\nThis transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-80898", "cvss": {"score": 0.0, "vector": "NONE"}, "status": "cve,poc"}], "exploitdb": [{"lastseen": "2016-02-03T05:31:45", "osvdbidlist": ["95927"], "references": [], "edition": 1, "description": "INSTEON Hub 2242-222 - Lack of Web and API Authentication. CVE-2013-4859. Webapps exploit for hardware platform", "reporter": "Trustwave's SpiderLabs", "published": "2013-08-02T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "type": "exploitdb", "title": "INSTEON Hub 2242-222 - Lack of Web and API Authentication", "bulletinFamily": "exploit", "cvelist": ["CVE-2013-4859"], "modified": "2013-08-02T00:00:00", "id": "EDB-ID:27284", "href": "https://www.exploit-db.com/exploits/27284/", "sourceData": "Trustwave SpiderLabs Security Advisory TWSL2013-023:\r\nLack of Web and API Authentication Vulnerability in INSTEON Hub\r\n\r\nPublished: 8/01/13\r\nVersion: 1.0\r\n\r\nVendor: INSTEON (http://www.INSTEON.com/)\r\nProduct: Hub\r\n\r\nVersion affected: 2242-222 (model discontinued)\r\n\r\nProduct description:\r\nHome automation controller for INSTEON and X10 compatible devices such as,\r\nlights, RF deadbolts/door locks, Window/door sensors, thermostats, etc.\r\n\r\nFinding 1: Lack of Web and API Authentication\r\n*****Credit: David Bryan of Trustwave SpiderLabs\r\nCVE: CVE-2013-4859\r\nCWE: CWE-306\r\n\r\nThe INSTEON Hub allows users to control their home automation devices from\r\ntheir home, and across the Internet. To allow control of the devices from\r\nthe Internet requires that a user create a port forward from the Internet\r\nto the Hub on their home network. This is to allow direct access from a\r\nusers smart phone. The hub will display a web page that is a legacy of their\r\nprevious hardware version of home automation control systems. This page\r\nallows anonymous access to control any devices connected to the Hub, if the\r\nuser has not set a user name and password. Additionally it reveals the\r\nname of the device, and what city and timezone the device is located.\r\n\r\nBecause INSTEON does not restrict the user in the naming of their device,\r\nit is possible for users to use their street address in the naming. Having\r\naccess to the name of the city, make locating the device trivial using\r\nmapping software to search for the house and street name of the controller,\r\nand potentially identify the location of the device. The web interface\r\ndoes not require the user to set authentication or authorization to make\r\nrequests to the Hub. This allows an anonymous threat agent access to turn\r\non and off lights/devices, change temperature settings on thermostats, or\r\neven open electronic door locks. Additionally a threat agent also has\r\naccess to a buffer command, where they can see what lights or devices were\r\nturned on or off. For example, an ON Command is a simple GET request of:\r\n\r\n\r\nhttp://A.B.C.D:8001/3?0262XXYYZZ0F11FF=I=3\r\n\r\nThis turns on the device, and does not require authentication to perform\r\nthis action. XXYYZZ is the ID of the INSTEON device.\r\n\r\nAn OFF Command is a simple GET request of:\r\nhttp://A.B.C.D:8001/3?0262XXYYZZ0F1100=I=3\r\n\r\nThis turns the device off, and does not require authentication to perform\r\nthis action.\r\n\r\nhttp://A.B.C.D:8001/buffstatus.xml request, without any sort of authentication taking place:\r\n\r\n<response><BS>02622026AA0F11FF0602502026AA1E965F2F11FF000000000000000000000000000000000000000000000000000000000000</BS></response>\r\n\r\n>From that response,it is possible to gather what INSTEON devices that were last used.\r\n>From there an attacker can then go back and easily decode the buffer status\r\nmessage and turn those devices on or off.\r\n\r\nAdditionally, the device does not have the capability to enable SSL/TLS to\r\nencrypt the data in transit. This allows any anonymous threat agent to\r\nview, intercept, and replay commands. It also does not prevent someone\r\nfrom capturing authentication credentials when the device is accessed via\r\nthe Internet.\r\n\r\n\r\nRemediation Steps:\r\nThe vendor has recalled and discontinued affected units. Trustwave\r\nSpiderLabs has confirmed that Model 2422-222R is not affected by this\r\nvulnerability.\r\n\r\nVendor Communication Timeline:\r\n12/27/12 - Vulnerability disclosed to vendor\r\n03/16/13 - Vendor emails upgrade notice\r\n07/17/13 - Advisory disclosed to vendor\r\n08/01/13 - Advisory published\r\n\r\nReferences\r\n1. http://www.INSTEON.com/support.html\r\n\r\nAbout Trustwave:\r\nTrustwave is the leading provider of on-demand and subscription-based\r\ninformation security and payment card industry compliance management\r\nsolutions to businesses and government entities throughout the world. For\r\norganizations faced with today's challenging data security and compliance\r\nenvironment, Trustwave provides a unique approach with comprehensive\r\nsolutions that include its flagship TrustKeeper compliance management\r\nsoftware and other proprietary security solutions. Trustwave has helped\r\nthousands of organizations--ranging from Fortune 500 businesses and large\r\nfinancial institutions to small and medium-sized retailers--manage\r\ncompliance and secure their network infrastructure, data communications and\r\ncritical information assets. Trustwave is headquartered in Chicago with\r\noffices throughout North America, South America, Europe, Africa, China and\r\nAustralia. For more information, visit https://www.trustwave.com\r\n\r\nAbout Trustwave SpiderLabs:\r\nSpiderLabs(R) is the advanced security team at Trustwave focused on\r\napplication security, incident response, penetration testing, physical\r\nsecurity and security research. The team has performed over a thousand\r\nincident investigations, thousands of penetration tests and hundreds of\r\napplication security tests globally. In addition, the SpiderLabs Research\r\nteam provides intelligence through bleeding-edge research and proof of\r\nconcept tool development to enhance Trustwave's products and services.\r\nhttps://www.trustwave.com/spiderlabs\r\n\r\nDisclaimer:\r\nThe information provided in this advisory is provided \"as is\" without\r\nwarranty of any kind. Trustwave disclaims all warranties, either express or\r\nimplied, including the warranties of merchantability and fitness for a\r\nparticular purpose. In no event shall Trustwave or its suppliers be liable\r\nfor any damages whatsoever including direct, indirect, incidental,\r\nconsequential, loss of business profits or special damages, even if\r\nTrustwave or its suppliers have been advised of the possibility of such\r\ndamages. Some states do not allow the exclusion or limitation of liability\r\nfor consequential or incidental damages so the foregoing limitation may not\r\napply.\r\n\r\n________________________________\r\n\r\nThis transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://www.exploit-db.com/download/27284/"}], "zdt": [{"lastseen": "2018-02-06T07:18:04", "references": [], "edition": 2, "description": "Exploit for hardware platform in category web applications", "reporter": "Trustwave's Spide.", "published": "2013-08-03T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "type": "zdt", "title": "INSTEON Hub 2242-222 - Lack of Web and API Authentication", "bulletinFamily": "exploit", "cvelist": ["CVE-2013-4859"], "modified": "2013-08-03T00:00:00", "id": "1337DAY-ID-21067", "href": "https://0day.today/exploit/description/21067", "sourceData": "The INSTEON Hub allows users to control their home automation devices from\r\ntheir home, and across the Internet. To allow control of the devices from\r\nthe Internet requires that a user create a port forward from the Internet\r\nto the Hub on their home network. This is to allow direct access from a\r\nusers smart phone. The hub will display a web page that is a legacy of their\r\nprevious hardware version of home automation control systems. This page\r\nallows anonymous access to control any devices connected to the Hub, if the\r\nuser has not set a user name and password. Additionally it reveals the\r\nname of the device, and what city and timezone the device is located.\r\n \r\nBecause INSTEON does not restrict the user in the naming of their device,\r\nit is possible for users to use their street address in the naming. Having\r\naccess to the name of the city, make locating the device trivial using\r\nmapping software to search for the house and street name of the controller,\r\nand potentially identify the location of the device. The web interface\r\ndoes not require the user to set authentication or authorization to make\r\nrequests to the Hub. This allows an anonymous threat agent access to turn\r\non and off lights/devices, change temperature settings on thermostats, or\r\neven open electronic door locks. Additionally a threat agent also has\r\naccess to a buffer command, where they can see what lights or devices were\r\nturned on or off. For example, an ON Command is a simple GET request of:\r\n \r\n \r\nhttp://A.B.C.D:8001/3?0262XXYYZZ0F11FF=I=3\r\n \r\nThis turns on the device, and does not require authentication to perform\r\nthis action. XXYYZZ is the ID of the INSTEON device.\r\n \r\nAn OFF Command is a simple GET request of:\r\nhttp://A.B.C.D:8001/3?0262XXYYZZ0F1100=I=3\r\n \r\nThis turns the device off, and does not require authentication to perform\r\nthis action.\r\n \r\nhttp://A.B.C.D:8001/buffstatus.xml request, without any sort of authentication taking place:\r\n \r\n<response><BS>02622026AA0F11FF0602502026AA1E965F2F11FF000000000000000000000000000000000000000000000000000000000000</BS></response>\r\n \r\n>From that response,it is possible to gather what INSTEON devices that were last used.\r\n>From there an attacker can then go back and easily decode the buffer status\r\nmessage and turn those devices on or off.\r\n \r\nAdditionally, the device does not have the capability to enable SSL/TLS to\r\nencrypt the data in transit. This allows any anonymous threat agent to\r\nview, intercept, and replay commands. It also does not prevent someone\r\nfrom capturing authentication credentials when the device is accessed via\r\nthe Internet.\r\n \r\n \r\nRemediation Steps:\r\nThe vendor has recalled and discontinued affected units. Trustwave\r\nSpiderLabs has confirmed that Model 2422-222R is not affected by this\r\nvulnerability.\r\n \r\nVendor Communication Timeline:\r\n12/27/12 - Vulnerability disclosed to vendor\r\n03/16/13 - Vendor emails upgrade notice\r\n07/17/13 - Advisory disclosed to vendor\r\n08/01/13 - Advisory published\r\n \r\nReferences\r\n1. http://www.INSTEON.com/support.html\r\n \r\nAbout Trustwave:\r\nTrustwave is the leading provider of on-demand and subscription-based\r\ninformation security and payment card industry compliance management\r\nsolutions to businesses and government entities throughout the world. For\r\norganizations faced with today's challenging data security and compliance\r\nenvironment, Trustwave provides a unique approach with comprehensive\r\nsolutions that include its flagship TrustKeeper compliance management\r\nsoftware and other proprietary security solutions. Trustwave has helped\r\nthousands of organizations--ranging from Fortune 500 businesses and large\r\nfinancial institutions to small and medium-sized retailers--manage\r\ncompliance and secure their network infrastructure, data communications and\r\ncritical information assets. Trustwave is headquartered in Chicago with\r\noffices throughout North America, South America, Europe, Africa, China and\r\nAustralia. For more information, visit https://www.trustwave.com\r\n \r\nAbout Trustwave SpiderLabs:\r\nSpiderLabs(R) is the advanced security team at Trustwave focused on\r\napplication security, incident response, penetration testing, physical\r\nsecurity and security research. The team has performed over a thousand\r\nincident investigations, thousands of penetration tests and hundreds of\r\napplication security tests globally. In addition, the SpiderLabs Research\r\nteam provides intelligence through bleeding-edge research and proof of\r\nconcept tool development to enhance Trustwave's products and services.\r\nhttps://www.trustwave.com/spiderlabs\r\n \r\nDisclaimer:\r\nThe information provided in this advisory is provided \"as is\" without\r\nwarranty of any kind. Trustwave disclaims all warranties, either express or\r\nimplied, including the warranties of merchantability and fitness for a\r\nparticular purpose. In no event shall Trustwave or its suppliers be liable\r\nfor any damages whatsoever including direct, indirect, incidental,\r\nconsequential, loss of business profits or special damages, even if\r\nTrustwave or its suppliers have been advised of the possibility of such\r\ndamages. Some states do not allow the exclusion or limitation of liability\r\nfor consequential or incidental damages so the foregoing limitation may not\r\napply.\n\n# 0day.today [2018-02-06] #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://0day.today/exploit/21067"}]}